sneakoscope 1.0.2 → 1.0.5

package/README.md

@@ -4,7 +4,13 @@ Fast legacy-free proof-first Codex trust layer with image-based Voxel TriWiki.
 
 Sneakoscope Codex (`sks`) is a Codex CLI/App harness that makes repeatable Codex work auditable.
 
-SKS **1.0.2** removes the last blanket TypeScript suppressions from runtime sources (`@ts-nocheck`/`@ts-ignore` are gated out by `npm run typecheck:suppressions`). The package remains `dist`-only, the typed command registry is still the genuine runtime registry, and release checks additionally block stray `.mjs` under `dist`, command-registry import drift (`blackbox:command-import-smoke`), typed contract probes, plus the new suppression + migration summaries.
+SKS **1.0.5** seals the Codex trust harness: hook outputs are validated against both vendored OpenAI Codex CLI `rust-v0.131.0` schemas and runtime semantic parser rules, codex-lb setup survives macOS user-session launches through env-file/Keychain/launchctl-aware repair surfaces, and Computer Use is the preferred macOS visual evidence capability when available.
+
+SKS **1.0.4** introduced the `rust-v0.131.0` schema snapshot, guided codex-lb setup path, and Computer Use/MAD-SKS separation that 1.0.5 now hardens into release gates.
+
+SKS **1.0.3** adds git-collaboration hygiene for shared TriWiki memory: `sks git ...`, tracked shared shards under `.sneakoscope/wiki/**`, runtime-only ignores, shared wrongness publish/sync, and Codex App hook trust-state generation for current hook trust syntax.
+
+SKS **1.0.2** removed the last blanket TypeScript suppressions from runtime sources (`@ts-nocheck`/`@ts-ignore` are gated out by `npm run typecheck:suppressions`). The package remains `dist`-only, the typed command registry is still the genuine runtime registry, and release checks additionally block stray `.mjs` under `dist`, command-registry import drift (`blackbox:command-import-smoke`), typed contract probes, plus suppression + migration summaries.
 
 SKS **1.0.2** also adds TriWiki Wrongness Memory: `sks wrongness ...` records negative evidence for wrong claims, stale or missing proof, test failures, image anchor mistakes, DB safety mismatches, hook policy mismatches, mock-real confusion, and trust overclaims. Active wrongness is retrieved by TriWiki/scouts and lowers or blocks trust until corrected.
 
@@ -15,7 +21,61 @@ SKS does not try to clone every other harness. It focuses on one thing: making C
 ![Sneakoscope Codex architecture and pipeline](https://raw.githubusercontent.com/mandarange/Sneakoscope-Codex/dev/docs/assets/sneakoscope-architecture-pipeline.jpg)
 
 
-## 1.0.2 Current Release Notes
+## 1.0.5 Ultimate Harness Seal
+
+SKS 1.0.5 treats Codex hook semantic compatibility as stricter than schema compatibility. `sks hooks warning-check --json` and `npm run hooks:semantic-check` fail if an output uses `permissionDecision:"ask"`, PreToolUse `allow` without `updatedInput`, Stop `continue:false`, `stopReason`, `suppressOutput`, snake_case keys, unknown fields, or legacy top-level hook decisions.
+
+codex-lb setup now has a durable setup/repair path:
+
+```bash
+sks codex-lb setup --host lb.example.com --api-key-stdin --yes --json
+sks codex-lb status --json
+sks codex-lb doctor --deep --json
+npm run codex-lb:missing-env-regression
+```
+
+The API key is written only to redacted status surfaces. The env file is `~/.codex/sks-codex-lb.env`, metadata is `~/.codex/sks-codex-lb.json`, and reports expose only a redacted presence state plus a fingerprint. Raw `CODEX_LB_API_KEY` missing-env errors are release failures.
+
+Computer Use is a Codex App/macOS capability, not a MAD-SKS or DB permission. Visual routes use:
+
+```bash
+sks computer-use status --json
+sks computer-use require --route '$QA-LOOP' --json
+npm run computer-use:visual-route-fixture
+```
+
+If Codex App or macOS blocks the capability, SKS records `external_capability_blocked`, `codex_app_missing`, `macos_permission_missing`, or the closest structured status and does not fabricate UI evidence.
+
+## 1.0.4 Codex CLI Compatibility
+
+SKS 1.0.4 targets OpenAI Codex CLI `rust-v0.131.0`. Hook outputs are validated against vendored upstream schemas, so SKS fails release checks if it emits deprecated hook shapes or unknown fields. `sks codex-lb setup` now guides users through domain/base URL and API key setup, stores secrets securely, and prevents raw `CODEX_LB_API_KEY` missing messages. On macOS, Computer Use is treated as a first-class Codex App visual evidence capability and is never blocked by MAD-SKS or a generic SKS safety policy.
+
+If the Codex App or OS itself denies Computer Use capability, SKS records `external_capability_blocked` and does not fabricate UI evidence.
+
+New checks:
+
+- `sks codex compatibility --json`
+- `sks codex doctor --json`
+- `sks hooks codex-validate --json`
+- `sks hooks warning-check --json`
+- `sks codex-lb setup --host <domain> --api-key-stdin --yes --json`
+- `sks computer-use status --json`
+
+## 1.0.3 Previous Release Notes
+
+SKS **1.0.3 makes TriWiki collaboration git-safe.** Shared claims, wrongness records, image voxels, and avoidance rules publish to one-record JSON shards; generated indexes are ignored and rebuilt. `.gitignore` no longer hides all of `.sneakoscope/`, so shared memory can be committed while missions, logs, reports, caches, and temporary packs stay local.
+
+New commands:
+
+- `sks git policy|install|status|doctor|precommit|publish-plan|summary`
+- `sks wiki publish latest --shared`
+- `sks wrongness publish latest --shared`
+- `sks wiki rebuild-index --json`
+- `sks wiki validate-shared --json`
+
+Codex App setup now writes hook trust-state hashes into `.codex/config.toml` for the managed `.codex/hooks.json`, matching the current Codex hook trust model.
+
+## 1.0.2 Previous Release Notes
 
 SKS **1.0.2 removes the blanket `@ts-nocheck` / `@ts-ignore` layer from runtime TypeScript.** The shipped package stays `dist`-only, keeps the typed command registry as the real runtime dispatcher, runs `npm run typecheck:suppressions` ahead of builds in `release:check`, and records migration counters under `.sneakoscope/reports/typescript-migration.*`.
 
@@ -72,9 +132,16 @@ Learn more:
 - TypeScript architecture: [docs/typescript-architecture.md](docs/typescript-architecture.md)
 - Trust Kernel: [docs/trust-kernel.md](docs/trust-kernel.md)
 - TriWiki Wrongness Memory: [docs/triwiki-wrongness-memory.md](docs/triwiki-wrongness-memory.md)
+- Git collaboration: [docs/git-collaboration.md](docs/git-collaboration.md)
+- Git hygiene: [docs/git-hygiene.md](docs/git-hygiene.md)
+- Shared TriWiki: [docs/shared-triwiki.md](docs/shared-triwiki.md)
+- Shared Wrongness Memory: [docs/shared-wrongness-memory.md](docs/shared-wrongness-memory.md)
+- Git policy: [docs/git-policy.md](docs/git-policy.md)
 - Wrongness Learning Loop: [docs/wrongness-learning-loop.md](docs/wrongness-learning-loop.md)
 - Package boundary: [docs/package-boundary.md](docs/package-boundary.md)
 - Black-box package tests: [docs/black-box-package-tests.md](docs/black-box-package-tests.md)
+- Codex CLI compatibility: [docs/codex-cli-compat.md](docs/codex-cli-compat.md)
+- Codex App: [docs/codex-app.md](docs/codex-app.md)
 - Core dominance: [docs/core-dominance.md](docs/core-dominance.md)
 - Performance budgets: [docs/performance-budgets.md](docs/performance-budgets.md)
 - Five-Scout Pipeline: [docs/five-scout-pipeline.md](docs/five-scout-pipeline.md)
@@ -101,6 +168,9 @@ sks doctor
 sks status
 sks trust report latest
 sks wrongness validate project --json
+sks git doctor --json
+sks codex compatibility --json
+sks hooks warning-check --json
 sks codex-app check
 sks selftest --mock
 sks rust smoke --json

package/crates/sks-core/Cargo.lock

@@ -76,7 +76,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "1.0.2"
+version = "1.0.5"
 dependencies = [
  "serde_json",
 ]

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "1.0.2"
+version = "1.0.5"
 edition = "2021"
 
 [dependencies]

package/crates/sks-core/src/main.rs

@@ -4,7 +4,7 @@ use std::io::{self, Read, Seek, SeekFrom};
 fn main() {
     let mut args = std::env::args().skip(1);
     match args.next().as_deref() {
-        Some("--version") => println!("sks-rs 1.0.2"),
+        Some("--version") => println!("sks-rs 1.0.5"),
         Some("compact-info") => {
             let mut input = String::new();
             let _ = io::stdin().read_to_string(&mut input);

package/dist/bin/sks.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-const FAST_PACKAGE_VERSION = '1.0.2';
+const FAST_PACKAGE_VERSION = '1.0.5';
 const args = process.argv.slice(2);
 try {
     if (args[0] === '--version' || args[0] === '-v' || args[0] === 'version') {